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REMARKS 

This Response is submitted in response to a non-final Office Action mailed September 11, 
2007. Applicants appreciate the Examiner's participation in the in-person interview with 
Applicants and Applicants' representative on January 3, 2008. 

Claims 1-17 are pending in the application. Claim 4 is objected to as a duplicate of claim 
3. Claims 1, 2, 5-8, and 10-17 stand rejected under 35 U.S.C. § 102(e) as allegedly anticipated 
by U.S. Publication No. 2003/0221 123 Al to Beavers (hereinafter "Beavers"). Claims 3 and 4 
stand rejected under 35 U.S.C. § 103(a) as allegedly unpatentable over Beaver in view of Best 
Practices inn Network Security by Frederick M. Avolio (hereinafter "Avolio"). Claim 9 is 
rejected under 35 U.S.C. § 103(a) as allegedly unpatentable over Beaver as exemplified by 
Intrusion Detection FAQ: Reconnaissance Techniques using Spoofed IP Addresses by Tom 
Chmielarski (hereinafter "Chmielarski"). 

Applicants have amended claims 1-17. The amendments above add no new subject 
matter. Support for the amendments may be found in the original specification and claims. 

Applicants respectfully traverse the Examiner's rejections and request reconsideration of 
the claims in light of the amendments above and remarks below. 

I. Claim 4 Objection. 

Claim 4 is objected to as a duplicate of claim 3. Applicants have amended claim 4 so that 
it is no longer a duplicate of claim 3. Applicants respectfully request that the Examiner 
withdraw the objection to claim 4 in light of the amendment. 

II. Claims 1, 2, 5-8, and 10-17. 

Claims 1, 2, 5-8, and 10-17 stand rejected under 35 U.S.C. § 102(e) as allegedly 
anticipated by U.S. Publication No. 2003/0221 123 Al to Beavers (hereinafter "Beavers"). In 
order to anticipate a claim under 35 U.S.C. § 102(b), a reference must teach each and every 
element of a claim. See MPEP § 2131. 

Respectfully, Beavers does not teach each and every element of the rejected claims. The 
system disclosed in Beavers receives as input security events or "alerts" that are generated by 
devices that monitor security-related threats. The system produces an incident declaration as 
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output. See 3, 9-1 1 . The purpose of the system in Beavers is to filter alerts in a network to 
alleviate the burden on overworked security administrator. See 4. The system in Beavers 
uses two types of decision tables in analyzing alerts, a correlation decision table and a watch list 
decision table. See 44, 48. The correlation decision table is a user-defined spreadsheet that 
allows a user to define a pattern of interest and a corresponding response. See ft 46, 49. The 
watch list decision table contains "information that should be remembered for possible incident 
declarations as further significant alerts are received;" it is essentially a buffer. See If 44. By 
default, it is constructed automatically based on the correlation decision table, but may also be 
edited by the user to override the automated construction. See Iflf 52. 

In contrast, in claim 1, Applicants claim "an authorization enforcement facility. . .operable 
to perform a risk-aware analysis of [a] connection to determine to determine [a] threat level 
associated with the connection based at least in part on the static policy data attribute." Beavers 
does not disclose a "an authorization enforcement facility. . .operable to perform a risk-aware 
analysis of [a] connection to determine to determine [a] threat level associated with the 
connection based at least in part on the static policy data attribute." Thus, claim 1 is patentable 
over Beavers, and Applicants respectfully request that the Examiner withdraw the rejection of 
claim 1. 

Claims 2, 5-8, and 10-12 depend from and further limit claim 1. Thus, claims 2, 5-8, and 
10-12 are patentable over Beavers for at least the same reasons as claim 1 . Applicants 
respectfully request that the Examiner withdraw the rejection of claims 2, 5-8, and 10-12. 

In claim 13, as amended, Applicants claim a method comprising "determining a threat 
level associated with the connection request based at least in part on the static policy data 
attribute." As discussed in relation to claim 1 above, Beavers does not disclose a method 
comprising "determining a threat level associated with the connection request based at least in 
part on the static policy data attribute." Thus Beavers does not anticipate claim 13, and 
Applicants respectfully request that the Examiner withdraw the rejection of claim 13. 

Claims 14-17 depend from and further limit claim 13. Thus, claims 14-17 are patentable 
over Beavers for at least the same reasons as claim 13. Applicants respectfully request that the 
Examiner withdraw the rejection of claims 14-17. 
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HI. Claims 3 and 4 under 35 U.S.C. § 103(a). 

Claims 3 and 4 stand rejected under 35 U.S.C. § 103(a) as allegedly unpatentable over 
Beaver in view of Avolio. In order to establish a prima facie case of obviousness, the reference 
must teach or suggest all of the claim limitations. See MPEP § 2143. 

Claims 3 and 4 depend from and further limit claim 1. As discussed above, Beavers fails 
to teach or suggest all of the claim limitations of claim 1. Avolio is introduced as teaching that 
the severity of a threat is based upon the value of the object being secured. See Office Action, 
page 6. Thus, Avolio does not cure the deficiencies of Beavers, and claims 3 and 4 are 
patentable over Beavers in view of Avolio. Further, claim 4 has been amended, and the rejection 
of claim 4 is thus moot. Applicants respectfully request that the Examiner withdraw the rejection 
of claims 3 and 4. 

IV. Claim 9. 

Claim 9 is rejected under 35 U.S.C. § 103(a) as allegedly unpatentable over Beaver as 
exemplified by Chmielarski. In order to establish a prima facie case of obviousness, the 
reference must teach or suggest all of the claim limitations. See MPEP § 2143. 

Claim 9 depends from and further limits claim 1. As discussed above, Beavers fails to 
teach or suggest all of the claim limitations of claim 1. Chmielarski is introduced as teaching 
active countermeasures. See Office Action, page 8. Thus, Chmielarski does not cure the 
deficiencies of Beavers, and claim 9 is patentable over Beavers in view of Chmielarski. 
Applicants respectfully request that the Examiner withdraw the rejection of Claim 9. 

V. Prior Art Made of Record and Not Relied Upon 

In the Conclusion, the Office Action list a references, which was made of record and not 
relied upon. During the interview, the Examiner requested that Applicants specifically consider 
these references. Applicants have done so. None of these references disclose a system 
comprising "an authorization enforcement facility. . .operable to perform a risk-aware analysis of 
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[a] connection to determine to determine [a] threat level associated with the connection based at 
least in part on the static policy data attribute" as recited in claim 1 . Nor do any of these 
references disclose a method comprising "determining a threat level associated with the 
connection request based at least in part on the static policy data attribute" as recited in claim 13. 

Applicants respectfully traverse the characterization and relevance of these references as 
prior art or otherwise, and respectfully reserve the right to present such arguments and other 
material should the Examiner maintain rejection of Applicants' claims, based upon the reference 
made of record and not relied upon or otherwise. 

VI. Conclusion 

Applicants respectfully submit that all the currently pending claims are allowable. A 
favorable Office Action is respectfully solicited. The Examiner is invited to contact the undersigned 
at 336-607-731 1 to discuss any matter related to the application. 



Kilpatrick Stockton LLP 
1001 West Fourth Street 
Winston-Salem, NC 27101-2400 
Phone: 336-607-7311 
Fax: 336-734-2621 



Respectfully submitted, 



Date: January 9. 2008 



/John C. Alemanni/ 
John C. Alemanni 
Registration No. 47,384 
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